session timeout

public/userarea/include/footer.php

@@ -1,3 +1,4 @@
 <footer class="page-footer">
     <p class="mb-0">C.E. Soft srl © 2025. All right reserved.</p>
-</footer>
+</footer>
+<?php include __DIR__ . '/session_timeout.php'; ?>

public/userarea/include/headscript.php

@@ -62,10 +62,27 @@ require_once(__DIR__ . '/../../languages/en/general.php');
 require_once __DIR__ . '/permissions_helper.php';
 require_once(__DIR__ . '/popup-moved.php');
 
-// Timbra la sessione dell'utente a ogni pagina (rolling manuale)
+// Timbra la sessione: tiene vive le sessioni ancora valide dell'utente e rinnova il cookie di Laravel
 try {
+	$now      = time();
+	$lifetime = (int)(function_exists('config') ? config('session.lifetime', 120) : 120);   // minuti
+	$table    = function_exists('config') ? config('session.table', 'auth_sessions') : 'auth_sessions';
+
 	$pdoSess = DBHandlerSelect::getInstance()->getConnection();
-	$pdoSess->prepare("UPDATE auth_sessions SET last_activity = ? WHERE user_id = ? ORDER BY last_activity DESC LIMIT 1")
-		->execute([time(), $iduserlogin]);
+	$pdoSess->prepare("UPDATE `$table` SET last_activity = ? WHERE user_id = ? AND last_activity > ?")
+		->execute([$now, $iduserlogin, $now - $lifetime * 60]);
+
+	// le pagine userarea non passano da Laravel: rinnovo io la scadenza del cookie di sessione
+	$cookie = function_exists('config') ? config('session.cookie') : null;
+	if ($cookie && !empty($_COOKIE[$cookie]) && !headers_sent() && !(function_exists('config') && config('session.expire_on_close'))) {
+		setcookie($cookie, $_COOKIE[$cookie], [
+			'expires'  => $now + $lifetime * 60,
+			'path'     => function_exists('config') ? (config('session.path') ?: '/') : '/',
+			'domain'   => function_exists('config') ? (config('session.domain') ?: '') : '',
+			'secure'   => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
+			'httponly' => true,
+			'samesite' => function_exists('config') ? (config('session.same_site') ?: 'Lax') : 'Lax',
+		]);
+	}
 } catch (\Throwable $e) { /* non bloccare la pagina */
 }

public/userarea/include/session_timeout.php

@@ -0,0 +1,32 @@
+<?php
+
+/**
+ * include/session_timeout.php - avviso "stai per essere scollegato" su tutte le pagine userarea.
+ * Da includere una volta in fondo a include/footer.php.
+ *
+ * Per escludere una pagina (es. postazioni tablet sempre accese) mettere PRIMA dell'include del footer:
+ *   $sessionTimeoutDisabled = true;
+ */
+if (!empty($sessionTimeoutDisabled)) return;
+
+// durata della sessione di Vanguard (minuti), come nel .env (SESSION_LIFETIME)
+$__stLifetime = 120;
+try {
+    if (function_exists('config')) $__stLifetime = (int)config('session.lifetime', 120);
+} catch (\Throwable $e) {
+}
+
+// indirizzo di uscita: la parte prima di /userarea/ + /logout (come il redirect al login di headscript.php)
+$__stScript = $_SERVER['SCRIPT_NAME'] ?? '';
+$__stPos = strpos($__stScript, '/userarea/');
+$__stBase = $__stPos !== false ? substr($__stScript, 0, $__stPos) : '';
+?>
+<script>
+    window.SESSION_TIMEOUT = {
+        lifetimeMin: <?= max(5, (int)$__stLifetime) ?>,
+        logoutUrl: <?= json_encode($__stBase . '/logout') ?>,
+        loginUrl: <?= json_encode($__stBase . '/login') ?>,
+        pingUrl: 'session_ping.php'
+    };
+</script>
+<script src="session_timeout.js?v=1"></script>